Framework
Zero Trust Architecture Framework
This framework defines the organization's approach to zero trust architecture (ZTA): the principles, pillars, control patterns, and migration model that bring identity, device, network, application, data, and workload controls into a coherent posture where trust is never implicit. It supports the migration from perimeter-based security to a model in which every request is authenticated, authorized, and continuously evaluated.
- Type
- Framework
- Version
- 0.0.10
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material architectural, threat, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Principles
- Pillars
- Policy engine
- Migration model
- Coordination with adjacent domains
- Operating expectations
- Framework alignment
- Limitations
Frameworks it maps to
- NIST SP 800-207
- NIST SP 800-207A
- CISA Zero Trust Maturity Model 2.0
- OMB M-22-09
- DoD Zero Trust Reference Architecture
- ISO/IEC 27001:2022
- ISO/IEC 27036
- CSA Software-Defined Perimeter
- NIST CSF 2.0
- CCCS ITSP.80.022
Related documents
- Information Security Policysecurity
- Identity and Access Management Policysecurity
- Network Communications Security Policysecurity
- Authentication and Password Management Standardsecurity
- Privileged Access Management Standardsecurity
- Logging and Monitoring Standardsecurity
- Network Security and Segmentation Standardoperations
- Cloud Security Configuration Baselineoperations
- Endpoint Management and Device Compliance Procedureoperations
- AI Access and Agent Permissions Standardai
- Bring Your Own Device (BYOD) Policysecurity
Next
All Documents